[#1524] tree: Make check APE error get wrapped to api status

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>

cmd/frostfs-cli/modules/object/nodes.go

@@ -1,15 +1,12 @@
 package object
 
 import (
-	"bytes"
-	"cmp"
 	"context"
 	"crypto/ecdsa"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 	"sync"
 
 	internalclient "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/client"
@@ -507,7 +504,6 @@ func isObjectStoredOnNode(ctx context.Context, cmd *cobra.Command, cnrID cid.ID,
 }
 
 func printPlacement(cmd *cobra.Command, objID oid.ID, objects []phyObject, result *objectNodesResult) {
-	normilizeObjectNodesResult(objects, result)
 	if json, _ := cmd.Flags().GetBool(commonflags.JSON); json {
 		printObjectNodesAsJSON(cmd, objID, objects, result)
 	} else {
@@ -515,34 +511,6 @@ func printPlacement(cmd *cobra.Command, objID oid.ID, objects []phyObject, resul
 	}
 }
 
-func normilizeObjectNodesResult(objects []phyObject, result *objectNodesResult) {
-	slices.SortFunc(objects, func(lhs, rhs phyObject) int {
-		if lhs.ecHeader == nil && rhs.ecHeader == nil {
-			return bytes.Compare(lhs.objectID[:], rhs.objectID[:])
-		}
-		if lhs.ecHeader == nil {
-			return -1
-		}
-		if rhs.ecHeader == nil {
-			return 1
-		}
-		if lhs.ecHeader.parent == rhs.ecHeader.parent {
-			return cmp.Compare(lhs.ecHeader.index, rhs.ecHeader.index)
-		}
-		return bytes.Compare(lhs.ecHeader.parent[:], rhs.ecHeader.parent[:])
-	})
-	for _, obj := range objects {
-		op := result.placements[obj.objectID]
-		slices.SortFunc(op.confirmedNodes, func(lhs, rhs netmapSDK.NodeInfo) int {
-			return bytes.Compare(lhs.PublicKey(), rhs.PublicKey())
-		})
-		slices.SortFunc(op.requiredNodes, func(lhs, rhs netmapSDK.NodeInfo) int {
-			return bytes.Compare(lhs.PublicKey(), rhs.PublicKey())
-		})
-		result.placements[obj.objectID] = op
-	}
-}
-
 func printObjectNodesAsText(cmd *cobra.Command, objID oid.ID, objects []phyObject, result *objectNodesResult) {
 	fmt.Fprintf(cmd.OutOrStdout(), "Object %s stores payload in %d data objects:\n", objID.EncodeToString(), len(objects))
 

cmd/frostfs-node/config/engine/config.go

@@ -41,6 +41,10 @@ func IterateShards(c *config.Config, required bool, f func(*shardconfig.Config)
 			c.Sub(si),
 		)
 
+		if sc.Mode() == mode.Disabled {
+			continue
+		}
+
 		// Path for the blobstor can't be present in the default section, because different shards
 		// must have different paths, so if it is missing, the shard is not here.
 		// At the same time checking for "blobstor" section doesn't work proper
@@ -50,10 +54,6 @@ func IterateShards(c *config.Config, required bool, f func(*shardconfig.Config)
 		}
 		(*config.Config)(sc).SetDefault(def)
 
-		if sc.Mode() == mode.Disabled {
-			continue
-		}
-
 		if err := f(sc); err != nil {
 			return err
 		}

cmd/frostfs-node/config/engine/config_test.go

@@ -18,6 +18,22 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestIterateShards(t *testing.T) {
+	fileConfigTest := func(c *config.Config) {
+		var res []string
+		require.NoError(t,
+			engineconfig.IterateShards(c, false, func(sc *shardconfig.Config) error {
+				res = append(res, sc.Metabase().Path())
+				return nil
+			}))
+		require.Equal(t, []string{"abc", "xyz"}, res)
+	}
+
+	const cfgDir = "./testdata/shards"
+	configtest.ForEachFileType(cfgDir, fileConfigTest)
+	configtest.ForEnvFileType(t, cfgDir, fileConfigTest)
+}
+
 func TestEngineSection(t *testing.T) {
 	t.Run("defaults", func(t *testing.T) {
 		empty := configtest.EmptyConfig()

cmd/frostfs-node/config/engine/testdata/shards.env

@@ -0,0 +1,3 @@
+FROSTFS_STORAGE_SHARD_0_METABASE_PATH=abc
+FROSTFS_STORAGE_SHARD_1_MODE=disabled
+FROSTFS_STORAGE_SHARD_2_METABASE_PATH=xyz

cmd/frostfs-node/config/engine/testdata/shards.json

@@ -0,0 +1,13 @@
+{
+  "storage.shard": {
+    "0": {
+      "metabase.path": "abc"
+    },
+    "1": {
+      "mode": "disabled"
+    },
+    "2": {
+      "metabase.path": "xyz"
+    }
+  }
+}

cmd/frostfs-node/config/engine/testdata/shards.yaml

@@ -0,0 +1,7 @@
+storage.shard:
+  0:
+    metabase.path: abc
+  1:
+    mode: disabled
+  2:
+    metabase.path: xyz

pkg/services/common/ape/checker.go

@@ -11,7 +11,6 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
-	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
@@ -104,14 +103,7 @@ func (c *checkerCoreImpl) CheckAPE(prm CheckPrm) error {
 	if found && status == apechain.Allow {
 		return nil
 	}
-	err = fmt.Errorf("access to operation %s is denied by access policy engine: %s", prm.Request.Operation(), status.String())
-	return apeErr(err)
-}
-
-func apeErr(err error) error {
-	errAccessDenied := &apistatus.ObjectAccessDenied{}
-	errAccessDenied.WriteReason(err.Error())
-	return errAccessDenied
+	return fmt.Errorf("access to operation %s is denied by access policy engine: %s", prm.Request.Operation(), status.String())
 }
 
 // isValidBearer checks whether bearer token was correctly signed by authorized

pkg/services/object_manager/placement/traverser.go

@@ -202,7 +202,7 @@ func sortVector(cfg *cfg, unsortedVector []netmap.NodeInfo) ([]netmap.NodeInfo,
 			metrics: m,
 		}
 	}
-	slices.SortFunc(nm, func(a, b nodeMetrics) int {
+	slices.SortStableFunc(nm, func(a, b nodeMetrics) int {
 		return slices.Compare(a.metrics, b.metrics)
 	})
 	sortedVector := make([]netmap.NodeInfo, len(unsortedVector))

pkg/services/tree/signature.go

@@ -11,6 +11,7 @@ import (
 	core "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/api/refs"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
+	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	cidSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	frostfscrypto "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto"
@@ -62,7 +63,16 @@ func (s *Service) verifyClient(ctx context.Context, req message, cid cidSDK.ID,
 		return fmt.Errorf("can't get request role: %w", err)
 	}
 
-	return s.checkAPE(ctx, bt, cnr, cid, op, role, pubKey)
+	if err = s.checkAPE(ctx, bt, cnr, cid, op, role, pubKey); err != nil {
+		return apeErr(err)
+	}
+	return nil
+}
+
+func apeErr(err error) error {
+	errAccessDenied := &apistatus.ObjectAccessDenied{}
+	errAccessDenied.WriteReason(err.Error())
+	return errAccessDenied
 }
 
 // Returns true iff the operation is read-only and request was signed